feat: two-way sync between support tickets and Gitea issues (v0.63.0)

Outbound (already existed one-way: ticket create -> Gitea issue) now
also mirrors status changes: closing/reopening a ticket in the admin
UI closes/reopens the linked Gitea issue, and replies posted from
Epicure (by the ticket owner or an admin) post as a comment on the
issue. Captures and stores the Gitea issue number at creation time
to address these follow-up calls without re-parsing the issue URL.

Inbound: new webhook receiver at /api/webhooks/gitea, verified via
HMAC-SHA256 signature (X-Gitea-Signature) with a configurable
GITEA_WEBHOOK_SECRET site setting, deduped by delivery id the same
way the existing Stripe receiver dedupes events. Handles "issues"
(closed/reopened -> ticket status) and "issue_comment" (created ->
appends to the ticket's comment thread), skipping comments Epicura
already posted itself (matched by Gitea comment id) to avoid loops.

New support_ticket_comments table backs a lightweight conversation
thread on both the user-facing support page and the admin support
manager, each comment tagged by author (user/admin/gitea).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/site-settings.ts

@@ -21,7 +21,8 @@ export type SiteSettingKey =
   | "AI_TOOL_CALLING_ENABLED"
   | "GITEA_URL"
   | "GITEA_TOKEN"
-  | "GITEA_REPO";
+  | "GITEA_REPO"
+  | "GITEA_WEBHOOK_SECRET";
 
 const SECRET_KEYS: SiteSettingKey[] = [
   "OPENAI_API_KEY",
@@ -29,6 +30,7 @@ const SECRET_KEYS: SiteSettingKey[] = [
   "OPENROUTER_API_KEY",
   "VAPID_PRIVATE_KEY",
   "GITEA_TOKEN",
+  "GITEA_WEBHOOK_SECRET",
 ];
 
 export function isSecretKey(key: SiteSettingKey): boolean {
@@ -71,6 +73,7 @@ export async function getAllSiteSettings(): Promise<Record<string, { value: stri
     "GITEA_URL",
     "GITEA_TOKEN",
     "GITEA_REPO",
+    "GITEA_WEBHOOK_SECRET",
   ];
 
   const result: Record<string, { value: string | null; isSecret: boolean; fromDb: boolean }> = {};